lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sat, 15 Jan 2022 13:26:43 +0100 From: Krzysztof Kozlowski <krzysztof.kozlowski@...onical.com> To: Krzysztof Kozlowski <krzysztof.kozlowski@...onical.com>, "David S. Miller" <davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org>, linux-nfc@...ts.01.org, netdev@...r.kernel.org, linux-kernel@...r.kernel.org Subject: [PATCH 0/7] nfc: llcp: fix and improvements Hi, Patch #1: ========= Syzbot reported an easily reproducible NULL pointer dereference which I was struggling to analyze: https://syzkaller.appspot.com/bug?extid=7f23bcddf626e0593a39 Although direct fix is obvious, I could not actually find the exact race condition scenario leading to it. The patch fixes the issue - at least under my QEMU - however all this code looks racy, so I have a feeling I am plumbing one leak without fixing root cause. Therefore I would appreciate some more thoughts on first commit. The rest of patches: ==================== These are improvements, rebased on top of #1, although should be independent. They do not fix any experienced issue, just look correct to me from the code point of view. Testing ======= Under QEMU only. The NFC/LLCP code was not really tested on a device. Best regards, Krzysztof Krzysztof Kozlowski (7): nfc: llcp: fix NULL error pointer dereference on sendmsg() after failed bind() nfc: llcp: nullify llcp_sock->dev on connect() error paths nfc: llcp: simplify llcp_sock_connect() error paths nfc: llcp: use centralized exiting of bind on errors nfc: llcp: use test_bit() nfc: llcp: protect nfc_llcp_sock_unlink() calls nfc: llcp: Revert "NFC: Keep socket alive until the DISC PDU is actually sent" net/nfc/llcp.h | 1 - net/nfc/llcp_core.c | 9 +------- net/nfc/llcp_sock.c | 54 ++++++++++++++++++++++++--------------------- 3 files changed, 30 insertions(+), 34 deletions(-) -- 2.32.0
Powered by blists - more mailing lists